Analysis
-
max time kernel
121s -
max time network
161s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
23-01-2025 22:07
General
-
Target
i.apk
-
Size
3.9MB
-
MD5
6ce8e6bafe3d51a058679137629ac19d
-
SHA1
31891442220a238bf51708fd370f681602beba1d
-
SHA256
4ba4f93bece0fe120af014a90d5546b22f3177d723076f368190af8f503e44d8
-
SHA512
043d9a09872bf936284c61da6d03808699e917f2a7e3c4e825ab7055e6cf7f3e03d38e468e9cfdd8594272705bed8c13d2074012bb3b06382d67c1fc9f5c6388
-
SSDEEP
98304:5AV29tyT2WcytslIhuYQwG34YS/lZ3qRPQYvVGGE:53ty6WfffCG/lxSQMGr
Score
7/10
Malware Config
Signatures
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.suldan.kecksy1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Uses Crypto APIs (Might try to encrypt user data)